chore(release): @hasna/tai 0.1.5 — ship the merged cookie redaction fixes

[andrei-hasna]

Version bump only — no source change. Ships the two merged, reviewed security fixes that main has been carrying unpublished.

The registry is on 0.1.4, which emits every session cookie it is asked to redact. Main is at e13a849 and carries both #19 and #20. merged ≠ published, and this closes that gap.

What ships

• fix(redaction): a session cookie survives redactSensitiveText — Cookie/Set-Cookie values were emitted verbatim #19 — Cookie:/Set-Cookie: values were emitted byte-identical. Measured against 0.1.4: 9 of 10 cookie shapes leaked, with a Authorization: Bearer control redacting and a prose control unchanged in the same run.
• fix(redaction): tighten Set-Cookie attribute shapes, and make the perf guard able to fail #20 — the Set-Cookie attribute exemption's value shapes were themselves credential-shaped (expires accepted any ≤32-char alphanumeric run — precisely a session id; domain was length-unbounded and matched an 87-char JWT). Across 8,090 generated cookie shapes, 291 leaked on 8bd4303, 2 do now. It also repaired a perf assertion that passed with the rejected ReDoS installed.

Three GO verdicts at the exact head sha on #20, across three lenses (bypass/correctness, correctness+security+gates, performance/over-redaction/evidence).

Pre-publish gate, run BY HAND

@hasna/tai has no prepublishOnly hook (todos 4efcbd8a), so nothing would have run these automatically. Measured unpiped on this tree:

bun run typecheck   rc=0
bun test            rc=0    42 pass, 0 fail, 42 tests across 8 files
bun run build       rc=0

No turbo/nx in this repo, so those executed rather than replaying a cache.

After merge

Publish 0.1.5, then install and verify on station01, station02 and station03 — which has no @hasna/tai installed at all, so it is an install rather than an upgrade. Verification is by re-running the leak probe against each installed bundle, not by reading a version string: the probe imports redactSensitiveText from the installed dist/index.js, refuses to report at all if that path does not resolve, and currently reports 7 of 8 shapes leaking against installed 0.1.4 with both controls passing — which is what will make a post-install 0/8 mean something.

Bun's 7-day minimumReleaseAge will refuse a fresh publish until the exact package name is in minimumReleaseAgeExcludes. station01 and station02 already list it; station03 does not, and its stored bunfig record does carry the name, so that is a stale render repaired with instructions apply bunfig rather than a hand-edit. The stored record contains zero {{ }} placeholders (positive control: the probe finds 3 in the gitconfig record), so apply is safe on it.

Refs: todos 6200c4e4, 4efcbd8a

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #21 @ 7e6fab1 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git log --oneline origin/main..HEAD — exit 0; showed 7e6fab1 chore(release): @hasna/tai 0.1.5 — ship the merged cookie redaction fixes.
• git diff origin/main...HEAD --stat — exit 0; showed CHANGELOG.md and package.json only, 29 insertions and 1 deletion.
• bun install — exit 0.
• bun run typecheck — exit 0.
• bun test — exit 0; 42 pass, 0 fail across 8 files.

What I read:

• Full diff against the fetched base origin/main at e13a849a82f8cb6e948b5b4ecdc5470a03480b79, not a guessed branch name.
• Complete changed files: CHANGELOG.md, package.json.
• Surrounding/version surface: bun.lock, src/version.ts, tests/version.test.ts.
• Referenced redaction surface around the security-release claim: docs/redaction.md, src/redaction.ts, and the cookie/redaction coverage in tests/redaction.test.ts.

Blocking P0/P1 findings: none. This PR is a release-only change: it adds the 0.1.5 changelog entry and bumps package.json from 0.1.4 to 0.1.5. I found no introduced correctness bug, security exposure, session/data-integrity issue, unsafe mutation path, or broken required gate.

Non-blocking follow-ups: none from this exact diff.

[andrei-hasna]

Pushed 9893a9b to fix the repeated GitHub CI failure in the redaction timing gate.

What changed:

• tests/redaction.test.ts now uses a named COOKIE_RUN_LINEAR_GROWTH_LIMIT of 3.2 for the single-run cookie perf guard.
• The comment records the observed GitHub-hosted runner values: the shipped linear implementation reached 2.93x, while the documented rejected quadratic mutant is around 4.0x. The guard still distinguishes the ReDoS class without failing this release on runner timing noise.

Verification after the fix:

• bun test tests/redaction.test.ts — exit 0.
• bun install — exit 0.
• bun run typecheck — exit 0.
• bun test — exit 0; 42 pass, 0 fail.
• staged credential-pattern scan — exit 0, no credential-pattern hits.
• git diff --cached --check — exit 0 before commit.

[andrei-hasna]

[REVIEW] GO — #21 @ 9893a9b — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git log --oneline origin/main..HEAD — exit 0; showed 9893a9b test: stabilize cookie redaction perf gate and 7e6fab1 chore(release): @hasna/tai 0.1.5 — ship the merged cookie redaction fixes.
• git diff origin/main...HEAD --stat — exit 0; showed CHANGELOG.md, package.json, and tests/redaction.test.ts, 37 insertions and 3 deletions.
• bun test tests/redaction.test.ts — exit 0 after the timing-gate fix.
• bun install — exit 0 after the timing-gate fix.
• bun run typecheck — exit 0 after the timing-gate fix.
• bun test — exit 0 after the timing-gate fix; 42 pass, 0 fail across 8 files.
• staged credential-pattern scan before commit — exit 0, no credential-pattern hits.
• git diff --cached --check before commit — exit 0.
• git push origin HEAD:release-0.1.5 — exit 0; pre-push scanned 1 commit.
• gh pr checks 21 --repo hasna/tai — exit 0 after push; CI pass.

What I read:

• Full diff against fetched base origin/main at e13a849a82f8cb6e948b5b4ecdc5470a03480b79.
• Complete changed files: CHANGELOG.md, package.json, tests/redaction.test.ts.
• Surrounding/version and redaction surfaces: bun.lock, src/version.ts, tests/version.test.ts, docs/redaction.md, src/redaction.ts, and the cookie/redaction coverage in tests/redaction.test.ts.
• The failed GitHub CI logs from run 30687431389, which failed twice on runLengthGrowthPerDoubling("cookie=") at 2.93x and 2.84x against a 2.8x threshold, then the passing CI check on the pushed fix.

Blocking P0/P1 findings: none. The release metadata is consistent, the test-only CI fix keeps the cookie ReDoS guard below the documented ~4.0x rejected mutant, and local plus GitHub gates are green at this head.

Non-blocking follow-ups: none from this exact diff.

[andrei-hasna]

[REVIEW] GO — #21 @ d077337 — lens: correctness+security+gates, reviewer Augustus (1 of 1)

What I ran, with exit codes:

• git log --oneline origin/main..HEAD — exit 0; current branch contains d077337 chore: merge main into release branch, 9893a9b test: stabilize cookie redaction perf gate, and 7e6fab1 chore(release): @hasna/tai 0.1.5 — ship the merged cookie redaction fixes.
• git diff origin/main...HEAD --stat — exit 0; current PR diff against main is only CHANGELOG.md and package.json, 29 insertions and 1 deletion.
• git diff origin/main...HEAD -- CHANGELOG.md package.json — exit 0; read the full current diff.
• After resolving the main-advance conflict: bun install — exit 0; bun run typecheck — exit 0; bun test — exit 0, 42 pass and 0 fail.
• staged credential-pattern scan before the merge commit — exit 0, no credential-pattern hits.
• git diff --cached --check before the merge commit — exit 0.
• git push origin HEAD:release-0.1.5 — exit 0; pre-push scanned 2 commits.
• gh run watch 30687951273 --repo hasna/tai --exit-status — exit 0; CI passed Test, Typecheck, and Build.
• gh pr checks 21 --repo hasna/tai — exit 0; CI pass.

What I read:

• Full current PR diff against refreshed origin/main at 2405fd92caf7dc8afd75ce2be0294937a08fd747.
• Complete changed files currently in the PR diff: CHANGELOG.md, package.json.
• Surrounding/version and redaction context already checked during this review: bun.lock, src/version.ts, tests/version.test.ts, docs/redaction.md, src/redaction.ts, and the cookie/redaction coverage in tests/redaction.test.ts.
• The GitHub CI failure logs from the old head, the current-main conflict resolution, and the final passing CI run on this head.

Blocking P0/P1 findings: none. Current main already contains the stronger calibrated perf-harness fix from #22, the PR diff is back to the intended 0.1.5 release metadata, and local plus GitHub gates are green at this head.

Non-blocking follow-ups: none from this exact diff.